@budibase/worker 2.11.40 → 2.11.41

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "2.11.40",
+  "version": "2.11.41",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -38,10 +38,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "2.11.40",
-    "@budibase/pro": "2.11.40",
-    "@budibase/string-templates": "2.11.40",
-    "@budibase/types": "2.11.40",
+    "@budibase/backend-core": "2.11.41",
+    "@budibase/pro": "2.11.41",
+    "@budibase/string-templates": "2.11.41",
+    "@budibase/types": "2.11.41",
     "@koa/router": "8.0.8",
     "@techpass/passport-openidconnect": "0.3.2",
     "@types/global-agent": "2.1.1",
@@ -108,5 +108,5 @@
       }
     }
   },
-  "gitHead": "386e2b81ef2ca25ee891f07be477723987dd9306"
+  "gitHead": "cfb21ffd5e3a748cd275a7fa91cb357e9df3973b"
 }

package/src/api/controllers/global/users.ts

@@ -189,7 +189,10 @@ export const destroy = async (ctx: any) => {
 
 export const getAppUsers = async (ctx: Ctx<SearchUsersRequest>) => {
   const body = ctx.request.body
-  const users = await userSdk.db.getUsersByAppAccess(body?.appId)
+  const users = await userSdk.db.getUsersByAppAccess({
+    appId: body.appId,
+    limit: body.limit,
+  })
 
   ctx.body = { data: users }
 }

package/src/api/routes/global/tests/users.spec.ts

@@ -569,9 +569,13 @@ describe("/api/global/users", () => {
         {
           query: { equal: { firstName: user.firstName } },
         },
-        501
+        { status: 501 }
       )
     })
+
+    it("should throw an error if public query performed", async () => {
+      await config.api.users.searchUsers({}, { status: 403, noHeaders: true })
+    })
   })
 
   describe("DELETE /api/global/users/:userId", () => {

package/src/api/routes/global/users.ts

@@ -72,7 +72,8 @@ router
   )
 
   .get("/api/global/users", auth.builderOrAdmin, controller.fetch)
-  .post("/api/global/users/search", auth.builderOrAdmin, controller.search)
+  // search can be used by any user now, to retrieve users for user column
+  .post("/api/global/users/search", controller.search)
   .delete("/api/global/users/:id", auth.adminOnly, controller.destroy)
   .get(
     "/api/global/users/count/:appId",

package/src/tests/api/users.ts

@@ -134,13 +134,19 @@ export class UserAPI extends TestAPI {
       .expect(status ? status : 200)
   }
 
-  searchUsers = ({ query }: { query?: SearchQuery }, status = 200) => {
-    return this.request
+  searchUsers = (
+    { query }: { query?: SearchQuery },
+    opts?: { status?: number; noHeaders?: boolean }
+  ) => {
+    const req = this.request
       .post("/api/global/users/search")
-      .set(this.config.defaultHeaders())
       .send({ query })
       .expect("Content-Type", /json/)
-      .expect(status ? status : 200)
+      .expect(opts?.status ? opts.status : 200)
+    if (!opts?.noHeaders) {
+      req.set(this.config.defaultHeaders())
+    }
+    return req
   }
 
   getUser = (userId: string, opts?: TestAPIOpts) => {